Archive

complete data not coming through search

harshal94
Engager

When I run the following query , I am getting data for limited days.
Eg. When I run this query for 1 month ,I didn't get data in stats for last 7 days.

index=dmzwebprod sourcetype=access_combined uri="checkout" host=EU status=200 | eval date_d=strftime(_time,"%Y-%m-%d")|stats count as Checkout by date_d | appendcols [search index=dmzwebprod source=access uri="checkout/orderConfirmation" host=EU status=200 | eval date_d=strftime(_time,"%Y-%m-%d")|stats count as orders by date_d] | eval ConversionRate_OrdersCheckout=(orders/Checkout)*100

Here data is not coming for "orders" field for last 7 days. While I checked in its index ,data is there, just it is not appearing in stats when I ran query for say 1 month time duration.
What should be the possible issue here?

Tags (1)
0 Karma
1 Solution

damien_chillet
Builder

That is weird indeed... However i think you could make your search much more effective (and that might well solve the issue).
What do you think of the following?

  index=dmzwebprod sourcetype=access_combined (uri="checkout" OR uri="checkout/orderConfirmation") host=EU status=200 
    | time chart span=1d count by uri
    | rename checkout as Checkout, "checkout/orderConfirmation" as orders
    | eval ConversionRate_OrdersCheckout=(orders/Checkout)*100

View solution in original post

damien_chillet
Builder

That is weird indeed... However i think you could make your search much more effective (and that might well solve the issue).
What do you think of the following?

  index=dmzwebprod sourcetype=access_combined (uri="checkout" OR uri="checkout/orderConfirmation") host=EU status=200 
    | time chart span=1d count by uri
    | rename checkout as Checkout, "checkout/orderConfirmation" as orders
    | eval ConversionRate_OrdersCheckout=(orders/Checkout)*100

View solution in original post